CVE-2006-4447

Description

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit.

References

http://www.vupen.com/english/advisories/2007/0409

http://www.vupen.com/english/advisories/2006/3409

http://www.securityfocus.com/bid/23697

http://www.securityfocus.com/bid/19742

http://www.mandriva.com/security/advisories?name=MDKSA-2006:160

http://www.kb.cert.org/vuls/id/300368

http://www.debian.org/security/2006/dsa-1193

http://security.gentoo.org/glsa/glsa-200704-22.xml

http://security.gentoo.org/glsa/glsa-200608-25.xml

http://secunia.com/advisories/25059

http://secunia.com/advisories/25032

http://secunia.com/advisories/22332

http://secunia.com/advisories/21693

http://secunia.com/advisories/21660

http://secunia.com/advisories/21650

http://mail.gnome.org/archives/beast/2006-December/msg00025.html

http://lists.freedesktop.org/archives/xorg/2006-June/016146.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3